5 Steps to Reduce Privacy Breaches

Because the mortgage industry is one of the biggest collectors and processors of personal information, the Mortgage Bankers Association prepared the Protecting Personal Information: The Good, the Bad, the Ugly to guide the mortgage industry toward safeguarding such data in the Internet age.

“In this day and age, the issue of privacy has become more of a concern,” MBA vice chair Kieran Quinn said in the announcement. “This white paper will help firms that collect consumer-based personal information to be proactive in safeguarding it and establishing good, trusting relationships with customers.”

Research has found that roughly 7 million people became victims of identity theft in a 12-month period, which equals 19,178 victims per day or 799 victims per hour, and that the business community loses between $40,000 – $92,000 per name in fraudulent charges, according to the report. And, only 15% of victims have reportedly found out about the crime through a positive action taken by a business group that verified a submitted application or a reported change of address, while the remaining 85% found out through an adverse situation, such as denied credit or employment, MBA reported.

The Internet and its related technologies since the latter half of the 1990s continue to change how organizations conduct their business. While the Internet increases outreach and the delivery of services to borrowers, enabling organizations to become more operationally efficient, the collecting and processing of more customer personal information calls for organizations to prioritize protecting such data in order to retain consumer confidence and build a reputation of being a trusted provider of Internet-based services, MBA indicated.

“Revenue and profit are no longer the sole drivers of company benefits; being a trustworthy company is becoming just as important,” the authors wrote.

“Trust and reputation are key factors in a company’s relationship with its customers, and as that trust and reputation become enhanced over time, the company’s benefits will be enhanced as well.”

While a set of recommendations and best practices, based on mortgage industry standards, for protecting personal information is under way, MBA outlined five general use cases for personal information that can be applied to any mortgage entity.

MBA recommends that companies assess how and where personal information is collected, processed, transferred to other entities, stored and disposed.

Thus, such assessment needs to be done within local networks, as well as any third party service providers the company does business with. Upon assessment, organizations will be better prepared to implement security solutions that provide appropriate protection of personal information, MBA said.

Companies must acknowledge that personal information is a critical information asset and that it needs a relative level of management and security, MBA said. It also necessary to understand that a solution for securing data is not solely a technical solution, but one that involves people and processes as well.

Among the questions MBA said companies should ask themselves to start gauging where they stand in protection measures are whether they are pro actively working to understand applicable legislation and legal requirements for safeguarding personal information; if they are assessing their organizational boundaries as they relate to the collection, processing, transfer, storage and disposal of the data; and if they are making appropriate investments in protecting the data.

The paper cited “major security breaches” regarding unauthorized disclosure of personal information by CitiFinancial and Bank of America that made news headlines this year and caused consumers to become more cautious about how their information is managed and distributed, as well as lessened their trust in executing electronic transactions.

“One of the worst things that can happen to any company is to appear in the press as having performed something illegally or having made a negligent error that causes harm to many parties,” the authors said. “News of this stature typically erodes consumer trust in the company and can potentially have significant impact on the company’s financial status.”

To retain or regain consumer trust, beyond implementing a Securities Sockets Layer that protects the initial transfer of personal information from consumer’s Web browser to the company’s Web server, mortgage players now need to ensure the safeguarding of such data throughout workflow processes and the entire operating environment, according to the report.

The MBA recommended that companies implement and execute on daily basis security policies and procedures based on industry standards and best practices; employ security technologies that protect the data throughout the lifecycle of an electronic transaction; and have appropriately-trained personnel operating in trusted roles.

The white paper “was created to help raise the awareness that protecting personal information should absolutely be a high priority for our industry,” MBA chairman-elect John Robbins said in the announcement.